A Generic Ellipsoid Abstract Domain for Linear Time Invariant Systems

Transcription

1 A Generic Ellipsoid Abstract Domain for Linear Time Invariant Systems Pierre Roux 1 Romain Jobredeaux 2 Pierre-Loïc Garoche 1 Éric Féron 2 April 18, ONERA Toulouse, France 2 Georgia Tech Atlanta, Georgia, USA 1 / 26

2 Control-Command Critical Systems Critical systems rely on a control command computation core: flight commands of an aircraft; attitude control of a satellite; control of a car engine;... N 2 / 26

3 Stability of Linear Systems Those are reactive systems 3 / 26

4 Stability of Linear Systems Those are reactive systems periodically computing output as a combination of inputs and internal state variables. 3 / 26

5 Stability of Linear Systems Those are reactive systems periodically computing output as a combination of inputs and internal state variables. Goal Assuming a bound on inputs, we need to bound the outputs. 3 / 26

6 Stability of Linear Systems Those are reactive systems periodically computing output as a combination of inputs and internal state variables. Goal Assuming a bound on inputs, we need to bound the outputs. (for control theorists: open loop stability) 3 / 26

7 Stability of Linear Systems Those are reactive systems periodically computing output as a combination of inputs and internal state variables. Goal Assuming a bound on inputs, we need to bound the outputs. (for control theorists: open loop stability) We will focus on the (very common) case of linear systems. 3 / 26

8 Stability of linear systems, example // DiscreteStateSpace_A: A real_t A[16] = { , , , , , , , , , , , , , , , }; // DiscreteStateSpace_A: B real_t B[8] = { , , , , , , , }; static void MIMO_update(int_T tid) { static real_t xnew[4]; xnew[0] = (A[0])*St[0] + (A[1])*St[1] + (A[2])*St[2] + (A[3])*St[3]; xnew[0] += (B[0])*INPUT[0] + (B[1])*INPUT[1]; xnew[1] = (A[4])*St[0] + (A[5])*St[1] + (A[6])*St[2] + (A[7])*St[3]; xnew[1] += (B[2])*INPUT[0] + (B[3])*INPUT[1]; xnew[2] = (A[8])*St[0] + (A[9])*St[1] + (A[10])*St[2] + (A[11])*St[3]; xnew[2] += (B[4])*INPUT[0] + (B[5])*INPUT[1]; xnew[3] = (A[12])* St[0] + (A[13])*St[1] + (A[14])*St[2] + (A[15])*St[3]; xnew[3] += (B[6])*INPUT[0] + (B[7])*INPUT[1]; (void) memcpy(st, xnew, sizeof(real_t)*4); } 4 / 26

9 Stability of linear systems, example // DiscreteStateSpace_A: A real_t A[16] = { , , , , , , , , , , , , , , , }; // DiscreteStateSpace_A: B real_t B[8] = { , , , , , , , }; Result: if INPUT[0..1] remains in [ 1, 1] then St[0..3] remains in [-5, 5] static void MIMO_update(int_T tid) { static real_t xnew[4]; xnew[0] = (A[0])*St[0] + (A[1])*St[1] + (A[2])*St[2] + (A[3])*St[3]; xnew[0] += (B[0])*INPUT[0] + (B[1])*INPUT[1]; xnew[1] = (A[4])*St[0] + (A[5])*St[1] + (A[6])*St[2] + (A[7])*St[3]; xnew[1] += (B[2])*INPUT[0] + (B[3])*INPUT[1]; xnew[2] = (A[8])*St[0] + (A[9])*St[1] + (A[10])*St[2] + (A[11])*St[3]; xnew[2] += (B[4])*INPUT[0] + (B[5])*INPUT[1]; xnew[3] = (A[12])* St[0] + (A[13])*St[1] + (A[14])*St[2] + (A[15])*St[3]; xnew[3] += (B[6])*INPUT[0] + (B[7])*INPUT[1]; (void) memcpy(st, xnew, sizeof(real_t)*4); } 4 / 26

10 Quadratic invariants Linear invariants commonly used in static analysis are not well suited: at best costly; at worst no result. 5 / 26

11 Quadratic invariants Linear invariants commonly used in static analysis are not well suited: at best costly; at worst no result. y x 5 / 26

12 Quadratic invariants Linear invariants commonly used in static analysis are not well suited: at best costly; at worst no result. y x 5 / 26

13 Quadratic invariants Linear invariants commonly used in static analysis are not well suited: at best costly; at worst no result. Control theorists know for long that quadratic invariants are a good fit for linear systems. y y x x 5 / 26

14 Quadratic invariants Linear invariants commonly used in static analysis are not well suited: at best costly; at worst no result. Control theorists know for long that quadratic invariants are a good fit for linear systems. y y x x 5 / 26

15 1 Overall Method 2 Shape of the Ellipsoid 3 Floating Point Issues 4 Experimental Results 5 Related Work and Perspectives 6 / 26

16 1 Overall Method 2 Shape of the Ellipsoid 3 Floating Point Issues 4 Experimental Results 5 Related Work and Perspectives 7 / 26

17 Overall Method Lyapunov Stability Theorem For A R n n, B R n p, the sequence { x0 R n x k+1 = Ax k + Bu k is bounded for all u (R p ) N such that for all k N, u k 1 if and only if there exist P R n n positive definite such that A T P A P 0 where P 0 means that for all x R n : x 0 x T Px < 0. 8 / 26

18 Overall Method Lyapunov Stability, Invariant Invariant ellipsoid Moreover, there exist a λ { > 0 such that } x remains in the ellipsoid x R n x T P x λ. In Computer Science Language The property x T P x λ is a loop invariant. 9 / 26

19 { x Overall Method Lyapunov Stability, Illustration } x T Px 1 { Ax } x T Px 1 {Ax k + Bu u 1} Ax k x k 10 / 26

20 Overall Method Method Overall Method 1 First determine the shape of the ellipsoid by choosing a matrix P; 2 then find the smallest possible ratio λ such that x T P x λ is an invariant. 11 / 26

21 Overall Method Tools Definition (Semidefinite Programming) Minimize a linear objective function of variables y i under constraint k A 0 + y i A i 0 i=1 where the A i are known matrices and P 0 means x T P x 0 for all vector x. 12 / 26

22 Overall Method Tools Definition (Semidefinite Programming) Minimize a linear objective function of variables y i under constraint k A 0 + y i A i 0 i=1 where the A i are known matrices and P 0 means x T P x 0 for all vector x. Remark Efficient tools do exist. 12 / 26

23 1 Overall Method 2 Shape of the Ellipsoid 3 Floating Point Issues 4 Experimental Results 5 Related Work and Perspectives 13 / 26

24 Shape of the Ellipsoid What are we looking for? We look for a positive definite matrix P such that A T P A P / 26

25 Shape of the Ellipsoid What are we looking for? We look for a positive definite matrix P such that A T P A P 0. There are lot of very different solutions / 26

26 Shape of the Ellipsoid What are we looking for? We look for a positive definite matrix P such that A T P A P 0. There are lot of very different solutions......but we will then look for a λ > 0 such that x T P x λ is an invariant and the ellipsoid { x x T P x λ } should be small enough. Example y y x x is better than 14 / 26

27 Shape of the Ellipsoid What are we looking for? We look for a positive definite matrix P such that A T P A P 0. There are lot of very different solutions......but we will then look for a λ > 0 such that x T P x λ is an invariant and the ellipsoid { x x T P x λ } should be small enough. Example y y x x is better than Tested three heuristics. 14 / 26

28 1 Overall Method 2 Shape of the Ellipsoid 3 Floating Point Issues 4 Experimental Results 5 Related Work and Perspectives 15 / 26

29 Floating Point Issues Rounding Errors Actual computations are carried out with floating point numbers leading to rounding errors. Example int i = 0; float x = 0; while (i < ) { x += 0.1; ++i; } printf("%.0f\n", x); 16 / 26

30 Floating Point Issues Rounding Errors Actual computations are carried out with floating point numbers leading to rounding errors. Example int i = 0; float x = 0; while (i < ) { x += 0.1; ++i; } printf("%.0f\n", x); Gives ! 16 / 26

31 Floating Point Issues Rounding Errors Actual computations are carried out with floating point numbers leading to rounding errors. Example int i = 0; float x = 0; while (i < ) { x += 0.1; ++i; } printf("%.0f\n", x); Gives ! We have to distinguish two problems: rounding errors in the analyzed program; and rounding errors in the analyzer itself; 16 / 26

32 Floating Point Issues Rounding Errors Actual computations are carried out with floating point numbers leading to rounding errors. Example int i = 0; float x = 0; while (i < ) { x += 0.1; ++i; } printf("%.0f\n", x); Gives ! We have to distinguish two problems: rounding errors in the analyzed program; and rounding errors in the analyzer itself; both are addressed efficiently. 16 / 26

33 1 Overall Method 2 Shape of the Ellipsoid 3 Floating Point Issues 4 Experimental Results 5 Related Work and Perspectives 17 / 26

34 Experimental Results Our Prototype OCaml front-end to Scilab (lmisolver function). Only 2.5 kloc. Available under GPL at 18 / 26

35 Experimental Results Experimental Results Shape Bounds Valid [140.4; 189.9] Ex [22.2; 26.5] n=2, 1 input 0.23 [16.2; 17.6] [18.1; 25.2; 24.3; 33.7] Ex [6.3; 7.7; 2.2; 3.4] n=4, 1 input 0.40 [1.7; 2.0; 2.2; 2.5] Ex. 3 lead-lag 0.07 controller 0.17 [36.2; 36.1] n=2, 1 input 0.20 [38.8; 20.3] Ex. 4 LQG 0.09 [1.2; 0.9; 0.5] regulator 0.19 [0.9; 0.9; 0.9] n=3, 1 input 0.24 [0.7; 0.4; 0.3] Analysis times (in s) and bounds compared for the three heuristics. 19 / 26

36 Experimental Results Experimental Results, continued Shape Bounds Valid. Ex. 5 coupled 0.09 [9.8; 8.9; 11.0; 16.8] mass system 0.24 [5.7; 5.6; 6.4; 10.1] n=4, 2 inputs 0.48 [5.0; 4.9; 4.8; 4.7] Ex. 6 Butterworth 0.10 [7.5; 8.7; 6.1; 7.0; 6.5] low-pass filter 0.32 [3.6; 5.0; 4.7; 8.1; 8.9] n=5, 1 input 0.78 [2.3; 1.1; 1.9; 2.0; 2.9] Ex. 7 Dampened 0.07 [1.7; 2.1] oscillator 0.15 [2.0; 2.0] 0.20 n=2, no input 0.27 [1.5; 1.5] Ex. 8 Harmonic 0.08 [1.5; 1.5] oscillator 0.24 [1.5; 1.5] 0.20 n=2, no input 0.15 [1.5; 1.5] Analysis times (in s) and bounds compared for the three heuristics. 20 / 26

37 Experimental Results Experimental Results, continued (a) Ex. 1 (b) Ex. 2 (c) Ex. 3 (d) Ex. 4 Figure: Comparison of obtained ellipsoids by the three methods from lighter to darker, plus a random simulation trace ((b) and (d), being of dimension greater than 2, are cuts along planes containing the origin and two vectors of the canonical base, to show how the three different templates compare together). 21 / 26

38 Experimental Results Experimental Results, end (a) Ex. 5 (b) Ex. 6 (c) Ex. 7 (d) Ex. 8 Figure: Comparison of obtained ellipsoids by the three methods from lighter to darker, plus a random simulation trace (a) and (b), being of dimension greater than 2, are cuts along planes containing the origin and two vectors of the canonical base, to show how the three different templates compare together). 22 / 26

39 1 Overall Method 2 Shape of the Ellipsoid 3 Floating Point Issues 4 Experimental Results 5 Related Work and Perspectives 23 / 26

40 Related Work and Perspectives Related Work [Feret04] Adresses a more restricted class of systems. + Extremely precise thanks to formal expansion (unrolling). + Handles actual C code. + Proved industrially useful. [AdjéGaubertGoubault10] and [GawlitzaSeidl10] (policy iteration) Need to be given template ellipsoids. Does not address floating point issues. + Adresses a broader class of systems. + Can handle actual code. 24 / 26

41 Related Work and Perspectives Perspectives Adapt policy iteration. Include this new domain in our Lustre static analyzer. 25 / 26

42 Related Work and Perspectives Questions Thank you for your attention!? 26 / 26

43 Related Work and Perspectives Minimizing Condition Number We can look for the roundest possible ellipsoid by minimizing a new variable r in the extra constraint I P ri. Rationale: flat ellipsoids can yield a very bad bound on one of the variables. y x 27 / 31

44 Related Work and Perspectives Preserving the Shape Another heuristic is to minimize r (0, 1) in A T P A rp 0. Intuitively, the shape of ellipsoid that gets preserved the best through the update x k+1 = Ax k. y rp P x 28 / 31

45 Related Work and Perspectives All in One The two previous heuristics did not take B into account. 29 / 31

46 Related Work and Perspectives All in One The two previous heuristics did not take B into account. We could look for P maximizing r in P ri such that ( A T PA A T ) ( ) PBe i P 0 ei T B T PA 1 ei T B T τ PBe i 0 i 0 1 for all the vertices e i of the hypercube of dimension p. 29 / 31

47 Related Work and Perspectives All in One The two previous heuristics did not take B into account. We could look for P maximizing r in P ri such that ( A T PA A T ) ( ) PBe i P 0 ei T B T PA 1 ei T B T τ PBe i 0 i 0 1 for all the vertices e i of the hypercube of dimension p. + Previous equations amounts to the smallest ellipsoid such that x, u, u 1 x T P x 1 (Ax + Bu) T P (Ax + Bu) 1, i.e. theoretically the best solution. 29 / 31

48 Related Work and Perspectives All in One The two previous heuristics did not take B into account. We could look for P maximizing r in P ri such that ( A T PA A T ) ( ) PBe i P 0 ei T B T PA 1 ei T B T τ PBe i 0 i 0 1 for all the vertices e i of the hypercube of dimension p. + Previous equations amounts to the smallest ellipsoid such that x, u, u 1 x T P x 1 (Ax + Bu) T P (Ax + Bu) 1, i.e. theoretically the best solution. But in practice, it s hard to find a good solution. 29 / 31

49 Related Work and Perspectives Rounding Errors in the Program Knowing the precision of the floating point system used and the dimensions of matrices A and B of the analyzed system, we can compute two reals a and b such that if then (Ax + Bu) T P (Ax + Bu) λ fl(ax + Bu) T P fl(ax + Bu) a 2 λ + 2ab λ + b 2 with fl(e) the computation of e in any order and with any IEEE754 rounding mode (in practice a is near from 1 and b from 0). 30 / 31

50 Related Work and Perspectives Soundness of the result Checking the soundness of the result basically amounts to checking positive definiteness of a matrix. This is done by carefully bounding the rounding errors in a Cholesky decomposition. Hence an efficient soundness check (in O ( n 3) for an n n matrix). 31 / 31